Restrict inferred repository URLs to known forges

[andrew]

Only infer repository URLs from homepage, project, vanity import, and arbitrary metadata fields when they point to a known forge. Explicit repository fields continue to accept self-hosted hosts.

Add gitea.com to known forges and stop treating SourceForge project pages as repositories.

Follow-up to #55.

[Copilot]

Pull request overview

This PR tightens how the codebase infers repository URLs from non-authoritative metadata fields by only accepting URLs that point to a recognized forge, while keeping explicit repository fields permissive for self-hosted setups. It centralizes that behavior in urlparser.CanonicalURL, updates the known-forge allowlist, and adjusts multiple registry implementations plus tests accordingly.

Changes:

• Add gitea.com to the known-forge allowlist and stop treating sourceforge.net/projects/... pages as repositories.
• Introduce urlparser.CanonicalURL (known-forge-only) and switch “fallback/inferred” repository extraction to use it across several registries.
• Add/adjust tests to ensure non-forge homepages/project pages don’t get promoted to repository URLs.

Reviewed changes

Copilot reviewed 20 out of 20 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
internal/urlparser/urlparser.go	Adds gitea.com, removes SourceForge from known hosts, and introduces CanonicalURL to gate inference to known forges.
internal/urlparser/urlparser_test.go	Expands coverage for IsKnownHost and adds CanonicalURL tests (including SourceForge project page rejection).
internal/pypi/pypi.go	Uses CanonicalURL for non-explicit URL fallbacks while preserving Parse for explicit repo-like keys.
internal/pypi/pypi_test.go	Adds tests ensuring only known-forge fallbacks are used when extracting repo URL.
internal/pub/pub.go	Uses CanonicalURL when falling back from explicit repository to homepage.
internal/pub/pub_test.go	Adds regression test to ensure non-forge homepage is not used as repository.
internal/nuget/nuget.go	Uses CanonicalURL to avoid treating general ProjectURL pages as repositories unless on a known forge.
internal/nuget/nuget_test.go	Updates ProjectURL fixture and asserts repository remains empty for non-forge project pages.
internal/homebrew/homebrew.go	Uses CanonicalURL to avoid inferring repository from non-forge formula homepages.
internal/homebrew/homebrew_test.go	Adds assertion that non-forge homepage does not populate repository.
internal/hex/hex.go	Uses CanonicalURL for homepage/website fallback to avoid non-forge inference.
internal/hex/hex_test.go	Adds regression test to ensure non-forge “Website” link does not populate repository.
internal/haxelib/haxelib.go	Uses CanonicalURL for Website-based repository extraction.
internal/haxelib/haxelib_test.go	Adds regression test for non-forge website not populating repository.
internal/golang/golang.go	Uses CanonicalURL for derived vanity/module-path repository inference (known forges only).
internal/golang/golang_test.go	Adds test ensuring vanity module paths do not derive a repository URL.
internal/dub/dub.go	Uses CanonicalURL for homepage fallback when explicit repository is absent.
internal/dub/dub_test.go	Adds regression test ensuring non-forge homepage is not used as repository.
internal/cran/cran.go	Uses CanonicalURL when extracting repository from CRAN URL field entries.
internal/cran/cran_test.go	Adds tests ensuring only known forges are accepted from the URL field.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.